Turning Standards into Features

Brian Zawada, FBCI Brian Zawada, FBCI | Jan 31, 2011

standards into featuresAs Published in the January/February 2011 Issue of Continuity Insights Magazine

A few weeks ago, I walked into my favorite electronics store with the objective of finding a new television. I had a general idea of what I wanted (I spent an hour or so researching televisions), as well as a general budget in mind. Right away, I found four flat-screen televisions that seemed to align with my needs, all of which met my budget. Then I saw a fifth option, but it was 20 percent more than what I wanted to spend. So, I called my wife to “sell” her on it. My pitch went something like this:

  • Uses 15% less power when compared to competitive models
  • A free Blu-Ray player that’s internet-ready (we could download movies and online content and stop traveling to the local video store)
  • Three-year unlimited warranty (the industry standard is 90-days)
  • 10” bigger (the picture would be so much better from the back couch)

Sold! The TV had all the features and benefits I wanted, and many more that I wasn’t even aware of when I entered the store.

TVs and Business Continuity
So what? Well, I think this experience has a lot to do with the state of our profession and its continuing maturity. We use planning approaches we’re familiar with, and because we’re often so busy, we don’t investigate all the ways to optimize preparedness. Considerable discussion is taking place regarding the use of new and revised business continuity standards. With the recent approval of the new ASIS Business Continuity Management System standard as an American National Standard and the anticipated 2011/2012 release of ISO preparedness standards, practitioners have – or will have – even more high-quality reference materials to consult to drive unprecedented levels of business continuity performance.

But how do we “sell” our organizations on leveraging these standards, or even just elements of one standard? One option that is emerging as a best practice is translating standards-based process recommendations into value-adding features.

Performance Issues
Organization X’s business continuity scorecard/self-assessment results look something like this:
Standards
What does the table above tell us? Well, not too much in terms of how ready the organization is for a disruptive event. However, it tells us some information about the outcomes of the planning process.

A Value-Oriented Crosswalk
“As the Director of Business Continuity for Organization X, I knew I had to do something. On the one hand, we had some great documentation that aligned to our organization. But the steering committee was poorly engaged, and our exercises told us very little about readiness. We had some problems with motivating management. “

“Searching for ideas to improve the business continuity program, I read two standards – NFPA 1600 and BS 25999.  Both advocated the use of management system concepts and each emphasized specific ideas to ensure readiness. “

The following table highlights attributes recommended and described in BS 25999-2 that could help improve readiness through organizational alignment and management engagement.

Standards Into Features
These are just a few examples designed to improve business continuity performance. Although BS 25999 is used in this example, others that can provide benefit include NFPA 1600 v2010, ASIS SPC.1.2009 and the new ASIS Business Continuity Management System standard (as well as many others).

Applying Standard-Based Recommendations
Simply-put, applying some of the process recommendations in our fictitious (but all-too-common) organization could deliver near-term results. Applying a standard such as BS 25999 could transform the methodology-oriented scorecard to something that looks like this.
Applying Standard
Discussed during a monthly management review process, the steering committee could offer perspective on priorities specific to risk mitigation and recovery options. Overall, the feedback from management will be positive because they know where to apply resources and they understand how planning issues impact readiness.

Conclusions
Budget some time to digest business continuity and other risk management-related standards. When standards development organizations release new standards, take the time to identify something new that you can apply to your organization’s preparedness efforts.

By definition, expert volunteers convene to author standards using consensus-based approaches. Great ideas come to light during the development process, and some of these ideas may help solve a problem that you’ve struggled with for some time. Identify some process ideas described in standards and turn them into features that your program sponsors and business customers would buy. In some cases, these features may not only improve readiness, but save time and resources over the long-term.

—————————

Brian Zawada
Avalution Consulting: Business Continuity Consulting